@tdk-landscape/tdk-cli-core 1.3.49 → 1.3.51

package/engine/topologies/platform/docker/compose/compose.star

@@ -23,6 +23,7 @@ load("../secrets/infisical.star", "get_infisical_environment_vars")
 load("../auth/auth.star", "AuthConfig")
 
 load("../constants.star", "PlatformDockerConstants")
+load("../config/healthcheck.star", "DOCKER_HEALTHCHECK", "compose_healthcheck_timing")
 
 # Load project name for dynamic host naming
 # Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
@@ -125,6 +126,7 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
     
     return """  {res_name}:
     image: {image_name}
+    init: true
 {build_config}
     <<: *frontend-memory-limit
     env_file:
@@ -138,12 +140,7 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
         - {network_backend}
     healthcheck:
       test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:{port}"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      # STORY 4 FIX: 30s grace period to prevent 504 errors on startup
-      start_period: 30s
-""".format(
+{healthcheck_timing}""".format(
         res_name=res_name, 
         image_name=image_name,
         build_config=build_config,
@@ -152,6 +149,7 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
         port=port,
         network_traefik_public=PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC,
         network_backend=PlatformDockerConstants.NETWORK_BACKEND,
+        healthcheck_timing=compose_healthcheck_timing(DOCKER_HEALTHCHECK["frontend_start_period_seconds"]),
     )
 
 
@@ -261,13 +259,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         )
         healthcheck_section = """    healthcheck:
       test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-      # STORY 4 FIX: 30s grace period to prevent 504 errors during startup
-      # Services get 30s to initialize before health checks begin
-      start_period: 30s
-""".format(internal_port=internal_port, health_path=health_path)
+""".format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
     infisical_env = get_infisical_environment_vars(as_array=True, resource_name=res_name)
     
     # Build auth environment variables section using centralized auth utilities
@@ -275,6 +267,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     return """
   {resource_entry_name}:
     image: {image_name}
+    init: true
     restart: unless-stopped
 {build_config}
 {ports_section}
@@ -619,7 +612,7 @@ services:
   {migrator_name}:
     image: {image_name}
     build:
-      context: ../../../../.
+      context: ../../../.
       dockerfile: {dockerfile_ref}
       target: migrator
     environment:

package/engine/topologies/platform/docker/compose/compose_helpers.star

@@ -40,7 +40,7 @@ def compose_build_config(resource_path, res_name, dockerfile=OUTPUT.AUTOGENERATE
         )
     
     base_config = """    build:
-      context: ../../../../.
+      context: ../../../.
       dockerfile: {full_dockerfile_path}""".format(
         full_dockerfile_path=full_dockerfile_path
     )

package/engine/topologies/platform/docker/compose/traefik_standalone.star

@@ -6,6 +6,8 @@
 # skip Traefik entirely and api.{project}.localhost never served.
 
 load("../constants.star", "PlatformDockerConstants")
+load("../config/healthcheck.star", "compose_healthcheck_timing")
+load("../networking/traefik_static_routes.star", "normalize_abs_path")
 
 
 def generate_standalone_traefik_compose():
@@ -24,6 +26,7 @@ services:
     restart: unless-stopped
     depends_on:
       - sablier
+      - wake-gateway
     command:
       - "--api.insecure=true"
       - "--ping=true"
@@ -31,6 +34,13 @@ services:
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.watch=true"
       - "--providers.docker.network={network}"
+      # Static routes for sablier.deferStart resources (openspec/changes/
+      # prioritized-cold-start): a never-created resource has no container
+      # and thus no Docker labels for the provider above to discover, so its
+      # route is defined here instead, pointed at wake-gateway. Harmless when
+      # no deferStart resource exists (empty directory, no routes emitted).
+      - "--providers.file.directory=/etc/traefik/dynamic"
+      - "--providers.file.watch=true"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--log.level=INFO"
@@ -44,15 +54,12 @@ services:
       - "8080:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./{dynamic_dir_name}:/etc/traefik/dynamic:ro
     networks:
       - traefik-public
     healthcheck:
       test: ["CMD", "traefik", "healthcheck", "--ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-      start_period: 10s
-
+{healthcheck_timing}
   sablier:
     image: sablierapp/sablier:1.18.0
     container_name: {name}_sablier
@@ -66,8 +73,61 @@ services:
     networks:
       - traefik-public
 
+  # Wake gateway (openspec/changes/prioritized-cold-start): fronts every
+  # deferStart resource's static route above. Triggers a cold resource (and
+  # its dependencies, which Tilt never cascades to on its own -- see design.md
+  # D3/task 1.5) via `tilt trigger`, or Sablier's own start when a container
+  # already exists, then holds the request until healthy. Needs the same
+  # Tilt session token Sablier/Traefik don't: confirmed empirically that
+  # `tilt trigger` from inside a container is otherwise rejected with
+  # "(403): invalid session token" even when the Tilt HTTP port is reachable.
+  wake-gateway:
+    build: ./{vendored_gateway_dir}
+    container_name: {gateway_container}
+    restart: unless-stopped
+    environment:
+      - TILT_HOST=host.docker.internal
+      - TILT_PORT=10350
+      - SABLIER_URL=http://sablier:10000
+      - PORT={gateway_port}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - {tilt_dev_dir}:/root/.tilt-dev:ro{project_root_mount}
+    networks:
+      - traefik-public
+
 networks:
   traefik-public:
     name: {network}
     external: true
-""".format(name=name, network=network)
+""".format(
+        name=name,
+        network=network,
+        healthcheck_timing=compose_healthcheck_timing(10),
+        dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
+        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+        gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
+        gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
+        tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
+        project_root_mount=_project_root_mount(),
+    )
+
+
+def _project_root_mount():
+    """Read-only mount of the project at its own absolute host path.
+
+    The gateway runs `docker compose up --no-build` for a deferred resource
+    itself (bypassing Tilt's build queue), using the compose files Tilt uses.
+    Compose resolves relative paths in them (env_file etc.) client-side, so
+    they must exist at the same absolute paths inside the gateway container.
+    Empty when TDK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
+    """
+    root = project_root_abspath()
+    if not root:
+        return ""
+    return "\n      - " + root + ":" + root + ":ro"
+
+
+def project_root_abspath():
+    """Absolute, normalized project root (TDK_PROJECT_ROOT), or "" when unset."""
+    return normalize_abs_path(os.environ.get("TDK_PROJECT_ROOT", ""))

package/engine/topologies/platform/docker/config/healthcheck.star

@@ -0,0 +1,56 @@
+# =============================================================================
+# Docker healthcheck timing - single source for golden images, L4 runtimes and
+# generated compose files.
+# =============================================================================
+# Steady-state probes are infrequent (each probe is a `docker exec`, which adds
+# up across 100+ containers), while `start_interval` keeps first-healthy time
+# fast during the start period. `start_interval` needs Docker Engine 25+ and
+# Compose 2.20.2+ (checked by `tdk doctor`).
+#
+# Override per run with environment variables, e.g.:
+#   TDK_HEALTHCHECK_INTERVAL_SECONDS=15 tdk up
+# =============================================================================
+
+
+def _env_int(name, default):
+    raw = os.environ.get(name, '')
+    if raw and raw.isdigit() and int(raw) > 0:
+        return int(raw)
+    return default
+
+
+DOCKER_HEALTHCHECK = {
+    "path": "/health",
+    "interval_seconds": _env_int("TDK_HEALTHCHECK_INTERVAL_SECONDS", 30),
+    "start_interval_seconds": _env_int("TDK_HEALTHCHECK_START_INTERVAL_SECONDS", 2),
+    "timeout_seconds": _env_int("TDK_HEALTHCHECK_TIMEOUT_SECONDS", 5),
+    "start_period_seconds": _env_int("TDK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
+    "frontend_start_period_seconds": _env_int("TDK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
+    "retries": _env_int("TDK_HEALTHCHECK_RETRIES", 3),
+}
+
+
+def dockerfile_healthcheck_flags(start_period_seconds = None):
+    """Flags for a Dockerfile `HEALTHCHECK` instruction."""
+    h = DOCKER_HEALTHCHECK
+    start_period = start_period_seconds if start_period_seconds != None else h["start_period_seconds"]
+    return "--interval={}s --start-interval={}s --timeout={}s --start-period={}s --retries={}".format(
+        h["interval_seconds"],
+        h["start_interval_seconds"],
+        h["timeout_seconds"],
+        start_period,
+        h["retries"],
+    )
+
+
+def compose_healthcheck_timing(start_period_seconds = None, indent = "      "):
+    """Timing keys for a compose `healthcheck:` block (everything except `test:`)."""
+    h = DOCKER_HEALTHCHECK
+    start_period = start_period_seconds if start_period_seconds != None else h["start_period_seconds"]
+    return (
+        indent + "interval: {}s\n".format(h["interval_seconds"])
+        + indent + "timeout: {}s\n".format(h["timeout_seconds"])
+        + indent + "retries: {}\n".format(h["retries"])
+        + indent + "start_period: {}s\n".format(start_period)
+        + indent + "start_interval: {}s\n".format(h["start_interval_seconds"])
+    )

package/engine/topologies/platform/docker/constants.star

@@ -62,6 +62,13 @@ NETWORK_DATABASE = PROJECT_NAME + "_database"
 NETWORK_INFISICAL = PROJECT_NAME + "_infisical-network"
 NETWORK_PROXY = PROJECT_NAME + "_proxy"
 
+# Traefik file-provider dynamic config: one generated YAML per `sablier.deferStart`
+# resource's static route (see openspec/changes/prioritized-cold-start), mounted
+# read-only into the standalone Traefik container at /etc/traefik/dynamic.
+TRAEFIK_DYNAMIC_DIR_REL = ".tdk/.tdk-out/traefik-dynamic"
+TRAEFIK_WAKE_GATEWAY_CONTAINER = PROJECT_NAME_HYPHEN + "-wake-gateway"
+TRAEFIK_WAKE_GATEWAY_PORT = 9999
+
 # NATS constants
 NATS_HOST = PROJECT_NAME + "_nats"
 NATS_PORT = "4222"
@@ -146,6 +153,9 @@ PlatformDockerConstants = struct(
     NETWORK_DATABASE = NETWORK_DATABASE,
     NETWORK_INFISICAL = NETWORK_INFISICAL,
     NETWORK_PROXY = NETWORK_PROXY,
+    TRAEFIK_DYNAMIC_DIR_REL = TRAEFIK_DYNAMIC_DIR_REL,
+    TRAEFIK_WAKE_GATEWAY_CONTAINER = TRAEFIK_WAKE_GATEWAY_CONTAINER,
+    TRAEFIK_WAKE_GATEWAY_PORT = TRAEFIK_WAKE_GATEWAY_PORT,
     NATS_HOST = NATS_HOST,
     NATS_PORT = NATS_PORT,
     NATS_URL = NATS_URL,

package/engine/topologies/platform/docker/layers/l1_base_layers.star

@@ -61,7 +61,7 @@ def L1_generate_os_base(base_image = None, maintainer = None, use_golden = True)
         "# ---- L1: os_base (" + base_image + ") ----\n"
         + "FROM " + base_image + " AS l1_os_base\n"
         + "LABEL maintainer=\"" + maintainer + "\"\n"
-        + "RUN apk add --no-cache ca-certificates tzdata curl file bash openssl \\\n"
+        + "RUN apk add --no-cache ca-certificates tzdata curl bash openssl \\\n"
         + "    && addgroup -S app && adduser -S app -G app\n"
         + "WORKDIR /app\n"
     )

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -1,7 +1,6 @@
 # === INLINED CONSTANTS for pure extension loading ===
 BASE_PORT_FRONTEND = 3000
 BASE_PORT_BACKEND = 4000
-get_docker_healthcheck_config = lambda: {"path": "/health", "interval": "10s", "timeout": "5s"}
 OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 # === END INLINED CONSTANTS ===
 
@@ -29,6 +28,7 @@ load('./prisma/prisma_runtime.star',
 )
 
 load('./bun_helpers.star', 'bun_hoisted_packages_symlink_fix')
+load('../config/healthcheck.star', 'DOCKER_HEALTHCHECK', 'dockerfile_healthcheck_flags')
 load('./infisical/infisical_docker.star', 'InfisicalDocker')
 
 
@@ -51,8 +51,55 @@ _docker_cfg = GLOBAL_CONFIG['docker']
 GOLDEN_L4_BACKEND_IMAGE = _docker_cfg.get('golden_l4_backend_image', _GOLDEN_PREFIX + '-l4-backend:latest')
 GOLDEN_L4_FRONTEND_IMAGE = _docker_cfg.get('golden_l4_frontend_image', _GOLDEN_PREFIX + '-l4-frontend:latest')
 
-# Load Docker healthcheck configuration
-_docker_health = get_docker_healthcheck_config()
+DEFAULT_BUN_START_COMMAND = 'bun run start'
+
+_ENTRY_FILE_EXTENSIONS = ['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.jsx', '.tsx']
+_SHELL_CHARS = ['=', '&', '|', ';', '$', '`', '<', '>', '(', ')', '"', "'", '*', '\\']
+
+
+def _is_entry_file(token):
+    if token.startswith('-'):
+        return False
+    for ch in _SHELL_CHARS:
+        if ch in token:
+            return False
+    for ext in _ENTRY_FILE_EXTENSIONS:
+        if token.endswith(ext):
+            return True
+    return False
+
+
+def start_command_from_script(start_script):
+    """
+    `bun run start` starts a Bun wrapper that spawns a second Bun runtime for the
+    real server. When the start script only runs one entry file, run that file
+    directly so each container holds a single Bun process. Anything else keeps
+    `bun run start` so custom start scripts behave exactly as before.
+    """
+    tokens = (start_script or '').split()
+    if len(tokens) == 3 and tokens[0] == 'bun' and tokens[1] == 'run' and _is_entry_file(tokens[2]):
+        return 'bun ' + tokens[2]
+    if len(tokens) == 2 and tokens[0] == 'bun' and _is_entry_file(tokens[1]):
+        return 'bun ' + tokens[1]
+    return DEFAULT_BUN_START_COMMAND
+
+
+def resolve_bun_start_command(res_path, cmd = DEFAULT_BUN_START_COMMAND):
+    """Resolve the runtime command from the service's package.json `start` script."""
+    if cmd != DEFAULT_BUN_START_COMMAND:
+        return cmd
+    package_json_path = res_path + '/package.json'
+    if not res_path.startswith('/'):
+        package_json_path = os.environ.get('TDK_PROJECT_ROOT', '.') + '/' + package_json_path
+    if not os.path.exists(package_json_path):
+        return cmd
+    package_json = read_json(package_json_path, default = {}) or {}
+    scripts = package_json.get('scripts', {}) or {}
+    return start_command_from_script(scripts.get('start', ''))
+
+
+def _cmd_instruction(command):
+    return "CMD [" + ", ".join(["\"" + part + "\"" for part in command.split()]) + "]\n"
 
 
 def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = False, resource_name = 'service', use_golden = True, use_prisma = True, has_prisma_config = False, manifest = None):
@@ -79,6 +126,7 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
     """
     # Normalize res_path for Docker COPY (must be relative to build context)
     res_path_rel = normalize_res_path(res_path)
+    cmd = resolve_bun_start_command(res_path, cmd)
     
     # Use golden L4-backend image if enabled (production-optimized backend runtime)
     base_image = GOLDEN_L4_BACKEND_IMAGE if use_golden else BUN_BASE
@@ -91,9 +139,6 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
         "ARG SKIP_INFISICAL_SETUP=0\n",
         "ENV NODE_ENV=production\n",
         "COPY --from=l3_production_purger /app/" + res_path + "/node_modules ./node_modules\n",
-        # Bun isolated linker creates service symlinks that resolve through /app/node_modules/.bun.
-        # Copy from production_purger to avoid dragging full dev dependency store into runtime.
-        "COPY --from=l3_production_purger /app/" + res_path + "/node_modules/.bun /app/node_modules/.bun\n",
         prisma_runtime_copy(res_path) if use_prisma else "",
         prisma_cli_runtime_copy(res_path) if use_prisma else "",
         "COPY --from=l3_backend_build /app/" + res_path + "/dist ./dist\n",
@@ -124,12 +169,7 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
     
     # Only add healthcheck if not using golden image (already in golden L4)
     if not use_golden:
-        parts.append("HEALTHCHECK --interval={}s --timeout={}s --start-period={}s --retries={} CMD bun --version || exit 1\n".format(
-            _docker_health["interval_seconds"],
-            _docker_health["timeout_seconds"],
-            _docker_health["start_period_seconds"],
-            _docker_health["retries"],
-        ))
+        parts.append("HEALTHCHECK " + dockerfile_healthcheck_flags() + " CMD bun --version || exit 1\n")
     
     if use_infisical:
         # Use InfisicalDocker generator for proper secret injection setup
@@ -143,7 +183,7 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
         )
         parts.append(infisical_setup)
     else:
-        parts.append("CMD [\"" + cmd + "\"]\n")
+        parts.append(_cmd_instruction(cmd))
 
     # Provide build targets that match external tooling (e.g. --target production/ development)
     parts.append("\nFROM l4_backend_runtime AS production\nFROM l4_backend_runtime AS development\n")
@@ -184,12 +224,7 @@ def L4_generate_frontend_runtime(res_path, target_path = '/usr/share/nginx/html'
             + "COPY --from=l3_frontend_build /app/" + res_path + "/dist " + target_path + "\n"
             + "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/nginx.autogenerated.conf /etc/nginx/conf.d/default.conf\n"
             + "EXPOSE 80\n"
-            + ("" if use_golden else "HEALTHCHECK --interval={}s --timeout={}s --start-period={}s --retries={} CMD curl -f http://localhost/ || exit 1\n".format(
-                _docker_health["interval_seconds"],
-                _docker_health["timeout_seconds"],
-                _docker_health["frontend_start_period_seconds"],
-                _docker_health["retries"],
-            ))
+            + ("" if use_golden else "HEALTHCHECK " + dockerfile_healthcheck_flags(DOCKER_HEALTHCHECK["frontend_start_period_seconds"]) + " CMD curl -f http://localhost/ || exit 1\n")
             + "CMD [\"nginx\", \"-g\", \"daemon off;\"]\n"
             + "FROM l4_frontend_runtime AS production\n"
             + "FROM l4_frontend_runtime AS development\n"
@@ -208,7 +243,7 @@ def L4_generate_frontend_runtime(res_path, target_path = '/usr/share/nginx/html'
         + "COPY --from=l3_frontend_build /app/" + res_path + "/" + OUTPUT.AUTOGENERATED_FOLDER + " ./" + OUTPUT.AUTOGENERATED_FOLDER + "\n"
         + "COPY " + res_path_rel + "/package.json ./package.json\n"
         + "EXPOSE " + str(expose_port) + "\n"
-        + 'CMD ["bun", "run", "start"]\n'
+        + _cmd_instruction(resolve_bun_start_command(res_path))
         + "FROM l4_frontend_runtime AS production\n"
         + "FROM l4_frontend_runtime AS development\n"
     )

package/engine/topologies/platform/docker/networking/traefik_static_routes.star

@@ -0,0 +1,161 @@
+# =============================================================================
+# Traefik static (file-provider) route for a deferred (`sablier.deferStart`)
+# resource -- see openspec/changes/prioritized-cold-start.
+# =============================================================================
+# A never-created resource has no container and thus no Docker labels, so its
+# route can't come from Traefik's Docker-label discovery the way every other
+# resource's does. This generates the file-provider equivalent instead:
+# same routing rule as the Docker-label `-project` router (traefik.star's
+# get_backend_traefik_labels), but pointed at the wake gateway with a fixed
+# LOW priority so the real, Docker-discovered router always wins once the
+# container exists (verified empirically -- see design.md D4: at equal
+# priority the file-provider router won even when the Docker-discovered
+# backend was healthy).
+#
+# Config for a request travels to the gateway via headers (X-Wake-*), not
+# the path/query. The route still strips the same `apiPath` prefix the real
+# Docker-label `-project` router strips (get_backend_traefik_labels) before
+# forwarding -- confirmed live against tdk-erp-system (task 7.2) that a
+# backend's app only serves its bare health path (e.g. `/health`), not the
+# full `/api/{name}/health` the public route is matched on; without this, the
+# gateway's own proxy-through would forward the unstripped path once healthy
+# and the app would 404 on it, even though the wake itself succeeded.
+
+load("./traefik_helpers.star", "project_backend_rule", "cli_api_path", "build_entrypoints")
+load("./traefik_constants.star",
+    "TRAEFIK_BACKEND_ENABLE_HTTP",
+    "TRAEFIK_BACKEND_ENABLE_HTTPS",
+)
+
+STATIC_ROUTE_PRIORITY = 1
+
+
+def normalize_abs_path(path):
+    """Absolute path with `.`/`..` segments collapsed, or "" for "".
+
+    Tilt's os.path.abspath does not collapse `..` (confirmed:
+    abspath("/a/.tdk/.tdk-out/../..") comes back unchanged), and the
+    generated Tiltfile's project root is exactly that shape
+    (config.main_dir + "/../.."). The gateway's project mount and the compose
+    paths in its route headers must match byte-for-byte, so both go through here.
+    """
+    if not path:
+        return ""
+    parts = []
+    for segment in os.path.abspath(path).split("/"):
+        if segment == "" or segment == ".":
+            continue
+        if segment == "..":
+            if parts:
+                parts.pop()
+            continue
+        parts.append(segment)
+    return "/" + "/".join(parts)
+
+
+def _container_name(compose_project_name, res_name):
+    """Docker Compose's own naming convention: <project>-<service>-<replica>.
+
+    Confirmed empirically against a live TDK container (analytics-autogenerated
+    -data-governance-api-1) -- see design.md D2 Context. Always replica 1: a
+    deferred resource's replica count is unrelated to which single instance
+    the wake gateway needs to address."""
+    return compose_project_name + "-" + res_name + "-1"
+
+
+def generate_static_wake_route(
+    resource_entry_name,
+    compose_project_name,
+    manifest,
+    internal_port,
+    gateway_host,
+    gateway_port,
+    dependencies=None,
+    compose_files=None,
+    env_file="",
+    image="",
+):
+    """YAML for one resource's Traefik file-provider dynamic-config entry.
+
+    `dependencies` is a list of (res_name, compose_project_name) tuples for
+    the resource's required startup dependencies (D5) -- each may live in a
+    different compose project than the resource itself, so the project name
+    travels alongside the resource name rather than being assumed shared.
+
+    `compose_files` (absolute paths), `env_file` and `image` let the gateway
+    create the container itself with `docker compose up --no-build` when the
+    image already exists, instead of waiting in Tilt's build queue behind
+    `tilt trigger`. Omitted headers make the gateway use `tilt trigger` only.
+
+    Written to the directory PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL
+    mounts into the standalone Traefik container (traefik_standalone.star).
+    """
+    dependencies = dependencies or []
+
+    rule = project_backend_rule(manifest, resource_entry_name)
+    api_path = cli_api_path(resource_entry_name, manifest)
+    entrypoints = build_entrypoints(TRAEFIK_BACKEND_ENABLE_HTTP, TRAEFIK_BACKEND_ENABLE_HTTPS)
+    router_name = resource_entry_name + "-wake"
+    headers_middleware_name = resource_entry_name + "-wake-headers"
+    strip_middleware_name = resource_entry_name + "-wake-strip"
+    service_name = resource_entry_name + "-wake-gateway"
+    container_name = _container_name(compose_project_name, resource_entry_name)
+    deps_header = ",".join([
+        dep_res_name + "=" + _container_name(dep_project_name, dep_res_name)
+        for dep_res_name, dep_project_name in dependencies
+    ])
+    compose_headers = ""
+    if compose_files and image:
+        compose_headers = (
+            '\n          X-Wake-Compose-Project: "' + compose_project_name + '"'
+            + '\n          X-Wake-Compose-Files: "' + ",".join(compose_files) + '"'
+            + '\n          X-Wake-Env-File: "' + env_file + '"'
+            + '\n          X-Wake-Image: "' + image + '"'
+        )
+
+    return """# SYSTEM-GENERATED - DO NOT EDIT (sablier.deferStart static wake route)
+http:
+  routers:
+    {router_name}:
+      rule: "{rule}"
+      entryPoints:
+        - {entrypoint}
+      service: {service_name}
+      middlewares:
+        - {strip_middleware_name}
+        - {headers_middleware_name}
+      priority: {priority}
+  middlewares:
+    {strip_middleware_name}:
+      stripPrefix:
+        prefixes:
+          - "{api_path}"
+    {headers_middleware_name}:
+      headers:
+        customRequestHeaders:
+          X-Wake-Resource: "{resource_entry_name}"
+          X-Wake-Container: "{container_name}"
+          X-Wake-Deps: "{deps_header}"
+          X-Wake-Proxy-Port: "{internal_port}"{compose_headers}
+  services:
+    {service_name}:
+      loadBalancer:
+        servers:
+          - url: "http://{gateway_host}:{gateway_port}"
+""".format(
+        router_name=router_name,
+        rule=rule,
+        entrypoint=entrypoints.split(",")[0],
+        service_name=service_name,
+        strip_middleware_name=strip_middleware_name,
+        headers_middleware_name=headers_middleware_name,
+        api_path=api_path,
+        priority=STATIC_ROUTE_PRIORITY,
+        resource_entry_name=resource_entry_name,
+        container_name=container_name,
+        deps_header=deps_header,
+        internal_port=internal_port,
+        compose_headers=compose_headers,
+        gateway_host=gateway_host,
+        gateway_port=gateway_port,
+    )

package/engine/topologies/tilt/generators/typescript/backend_tsconfig.star

@@ -64,7 +64,7 @@ def generate_backend_tsconfig(resource_path, prisma_path, write_fn, internal_dep
         # isolated linker), while @types/node is only a transitive dependency of
         # bun-types and isn't hoisted to the top level under the isolated linker -
         # "types": ["node"] fails to resolve there even though it works locally.
-        "types": ["bun"],
+        "types": ["node"],
     }
     content = {
         "compilerOptions": compiler_options,
@@ -114,7 +114,7 @@ def generate_backend_tsconfig(resource_path, prisma_path, write_fn, internal_dep
             "outDir": "./dist",
             "rootDir": docker_root_dir,
             # See note above: "bun" resolves under the isolated linker, "node" doesn't.
-            "types": ["bun"],
+            "types": ["node"],
         }
         docker_content = {
             "compilerOptions": docker_compiler_options,

package/engine/topologies/tilt/generators/typescript/frontend_tsconfig.star

@@ -93,7 +93,7 @@ def generate_frontend_tsconfig(resource_path, write_fn, internal_deps=None, is_d
             # (including Docker's isolated linker), while @types/node (when only pulled in
             # transitively, e.g. via bun-types) isn't hoisted under the isolated linker and
             # "types": ["node"] fails to resolve there even though it works locally.
-            "types": ["bun"],
+            "types": ["node"],
         },
         "exclude": [
             "node_modules",

package/engine/topologies/tilt/manifest/schema.star

@@ -277,6 +277,12 @@ MANIFEST_SCHEMA = {
                 'description': 'How long the resource stays up after its last request, as a Go duration (e.g. "10m", "1h")',
                 'example': '10m',
             },
+            'deferStart': {
+                'type': 'boolean',
+                'required': False,
+                'default': False,
+                'description': 'Skip this resource during tdk up entirely (no container is created or started); a Traefik static route wakes it and its dependencies on the first request instead. Requires enable: true.',
+            },
         },
         'description': 'On-demand scaling via Sablier: stop idle containers, wake them on the next request. Not recommended for stateful resources (databases) with in-flight writes. (Premium - requires TDK_LICENSE_KEY; see hasSablierLicense() in extension-fetch.ts)',
     },

package/engine/topologies/tilt/manifest/validator.star

@@ -388,6 +388,22 @@ def _validate_cross_field(manifest, context):
         else:
             stats['rules_passed'] += 1
     
+    # sablier.deferStart requires sablier.enable
+    sablier = manifest.get('sablier', {}) or {}
+    if sablier.get('deferStart', False):
+        stats['fields_checked'] += 1
+
+        if not sablier.get('enable', False):
+            errors.append(ManifestErrors.new(
+                message="sablier.deferStart requires sablier.enable to also be true",
+                category=ManifestErrors.CATEGORY['VALIDATION'],
+                severity=ManifestErrors.SEVERITY['ERROR'],
+                context={'field': 'sablier.deferStart', 'sablier': sablier},
+            ))
+            stats['rules_failed'] += 1
+        else:
+            stats['rules_passed'] += 1
+
     # Backend should have Traefik config
     if app_type == 'backend':
         stats['fields_checked'] += 1